YOUR DATA 


What is the Children’s code? 


The Children’s code is a data protection code 
of practice for online services, such as apps, 
online games, and web and social media sites 
that are likely to be accessed by children. 


e It came into force on 2 September 2020. 


Why has the Children’s code come 
into existence? 


e The United Nations Convention on the 
Rights of the Child (UNCRC) recognises that 
children need special safeguards and care 
in all aspects of their life. 


e Governments should ensure businesses 
operating in their countries respect 
children’s digital rights. 


e A child-friendly version of children’s 
digital rights can be found at: 
https: //5rightsfoundation.com 
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e The UK government asked the ICO to 
produce the Children’s code, which sets 
out specific protections for children’s 
personal data. 


How does the Children’s code work? 


e The Children’s code is a set of rules 
designed to make the internet a safer place 
for children to learn, explore and play. 


e The code requires services to put the best 
interests of the child first when they are 
designing and developing apps, games, 
connected toys and websites that are likely 
to be accessed by young people. 


e How will the code affect 
children and young people? 


e Online services - such as websites, games 
and apps - should only be collecting a 
minimum amount of young people’s data, 
and they shouldn’t share it. Children and 
young people may notice that their settings 
are set to private by default, geolocation 
services are switched off and nudge 
techniques are minimised. 


What is the full list of code 
standards that organisations have 
to conform to? 


The standards are: 


e Best interests of the child: online 
services likely to be accessed by children 
need to be designed with the best interest 
of the child in mind. 


e Data protection impact assessments: 
online companies should carry out an 
assessment of their services to make sure 
that children’s digital rights are respected. 


e Age appropriate application: Online 
companies need to think about how you can 
establish the age of your users, in order to 
correctly apply the Children’s code rules. 


e Transparency: Privacy policies must be 
written in clear language suited to the age 
of the child. 


e Detrimental use of data: Do not use 
children’s personal data in ways that are 
detrimental to their wellbeing. 


e Policies and community standards: 
Uphold your own published terms, policies 
and community standards (including but not 
limited to privacy policies, age restriction, 
behaviour rules and content policies). 


e Default settings: Settings must be ‘high 
privacy’ by default. 
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Information Commissioner's Office 


Data minimisation: Collect and retain 
only the minimum amount of personal 
data you need to provide the elements of 
your service in which a child is actively and 
knowingly engaged. Give children choices 
over which elements they wish to activate. 


Data sharing: Do not disclose children’s 
data unless strictly necessary and in the 
best interests of the child. 


Geolocation: Switch geolocation options 
off by default and provide an obvious sign 


for children when location tracking is active. 


Parental controls: If you provide parental 
controls, give the child age appropriate 
information about this. If your online 
service allows a parent or carer to monitor 
their child’s online activity or track their 
location, provide an obvious sign to the 
child when they are being monitored. 


Profiling: Switch options which use 
profiling ‘off’ by default (unless you can 
demonstrate a compelling reason for 
profiling to be on by default, taking account 
of the best interests of the child). Only 
allow profiling if you have appropriate 
measures in place to protect the child from 
any harmful effects (in particular, being fed 
content that is detrimental to their health 
or wellbeing). 


Nudge techniques: Do not use nudge 
techniques to lead or encourage children 
to provide unnecessary personal data or 


weaken or turn off their privacy protections. 


Connected toys and devices: Connected 
toys or devices must conform to the code. 


Online tools: Provide prominent and 


accessible tools to help children exercise their 


data protection rights and report concerns. 
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Where to find out more about the 
Children’s code: 


Visit https: / /ico.org.uk/ your-data- 
matters /the-children-s-code-what-is-it 


What should someone do if they 
spot a website or app that is not 
adhering to the Children’s code? 


The service should be contacted directly in 
the first instance and if the response is not 


adequately dealt with, any online service that 
is suspected of not adhering to the code should 


be reported to ICO at https: //ico.org.uk/ 
make-a-complaint/ 


